Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Warning: Not sure if this question is a good fit for this SE, but I need serious advice that I can get no where else

Over the weekend, massive number of files and folders were deleted from our DFS. I cannot find anyway to trace whether it was a program or someone who deleted them. There a a few things I observe:

  1. In root namespace, out of the folders that survived the mass delete, all had contents intact except for the first sub-folder ordered by name, which only has partial files intact. - this leads me to think files were deleted at the root folders in named sequence.
  2. In root namespace, all of the folders has partial content deleted. - this leads me to think that root folders were deleted in parallel.

Does a normal select all folders and delete generate this kind of deleting sequence? Is there anyway to trace who or what deleted it? I checked the auditing event logs but cannot find anything about deleting files and folders.

share|improve this question

migrated from Sep 29 '12 at 22:06

This question came from our site for computer enthusiasts and power users.

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.